APPENDICES Agricultural Calcium Ammonium Nitrate Security Code of Practice JANUARY 2019
TABLE OF CONTENTS SECTION A INBOUND SHIPMENTS... 3 SECTIONS A1 & A2 SECURITY OF INBOUND CAN CARGO... 4 SECTION A3 ACCESS TO PRODUCT DURING SHIPMENT... 7 SECTION A4 LOSS OR TAMPERING OF PRODUCT DURING SHIPMENT... 11 SECTION B STORAGE OF CALCIUM AMMONIUM NITRATE... 16 SECTION B1 PRODUCT STORAGE SECURITY... 17 SECTION B2 SECURITY PLAN... 21 SECTION B3 ACCESS BY ONSITE PERSONNEL... 48 SECTION B4 LOSS OF PRODUCT DURING STORAGE... 50 SECTION C OUTBOUND SHIPMENTS/PRODUCT SALES... 54 SECTION C1.1 SECURITY AROUND INDIVIDUALS OR COMPANY RESPONSIBLE... 55 FOR PROVIDING TRANSPORTATION... 55 SECTION C1.2 DELIVERY RECEIPT ACKNOWLEDGEMENT... 57 SECTION C2 ACCESS TO PRODUCT DURING SHIPMENT... 61 SECTION C3 VALIDATION OF CUSTOMERS... 65 SECTION C4 TRACEABILITY OF SALES RECORDS... 67 SECTION C5 CRITERIA SPECIFIC TO END-USERS (CUSTOMERS)... 69 Section D Training Records... 73 SECTION D TRAINING... 74 2
SECTION A INBOUND SHIPMENTS 3
SECTIONS A1 & A2 SECURITY OF INBOUND CAN CARGO PROVIDING TRANSPORT FROM SOURCE VIA RAIL/TRUCK PROTOCOLS: NO. A1.1 The distribution and/or retail facility has undertaken measures to ensure the security of inbound CAN cargo aboard import vessels. NO. A1.2 The distribution and/or retail facility has undertaken measures to ensure the security of inbound CAN cargo aboard railcars/trucks. Y/N Y/N NO. A2 The distribution and/or retail facility has undertaken measures to ensure all companies providing transportation services for CAN have appropriate security measures and clearances. Y/N AUDIT REQUIREMENTS: Signed and dated letter from the receiving facility manager indicating requirements have been reviewed and actions completed Letter is current and renewed every two years NOTE: Auditors may spot check documentation to ensure policies are being followed 4
EXAMPLE COMPLIANCE VERIFICATION LETTER [ TO BE PRINTED ON COMPANY LETTERHEAD ] January 28, 2019 COMPLIANCE VERIFICATION LETTER To be placed in Calcium Ammonium Nitrate Audit Verification File In accordance with Protocols A1 & A2 of the Calcium Ammonium Nitrate Security Code of Practice (2019), our facility located at: Street Address: City/Town: Province: has undertaken a review and is in compliance with the following requirements: PLEASE CHECK THE BOX IN FRONT OF THE SECTIONS THAT ARE APPLICABLE: Import by Marine Vessel The following requirements have been reviewed and our operation is in compliance based upon our internal audit. Protocol A1.1 by Marine: All Companies providing marine transportation services are in compliance with the following: Canada Marine Act Port Authorities Operations Regulations, Practices and Procedures for Public Ports; Public Ports and Public Port Facilities Regulations Canada Shipping Act Cargo, Fumigation and Tackle Regulations 5
Protocol A2: All Companies providing road/rail transportation services inbound to our operation have provided written verification that: a) They are bonded or pre-approved by an internal review; b) They have adequate insurance coverage before shipment; c) They have developed a security plan for shipments or have agreed to operate under the provisions of Section A3 of the Agricultural Calcium Ammonium Nitrate Security Code of Practice; and d) They will keep records of the shipment for a minimum of two years. Import by Rail/Road The following requirements have been reviewed and our operation is in compliance based upon our internal audit. Protocol A1.2 by Rail/Road: Carrier agrees to immediately notify the importer/receiver of any theft or tampering during transport. Protocol A2: All Companies providing road/rail transportation services inbound to our operation have provided written verification that: a) They are bonded or pre-approved by an internal review; b) They have adequate insurance coverage before shipment; c) They have developed a security plan for shipments or have agreed to operate under the provisions of Section A3 of the Agricultural Calcium Ammonium Nitrate Security Code of Practice; and d) They will keep records of the shipment for a minimum of two years. The signature below signifies that the calcium ammonium nitrate operation listed above is in compliance with the requirements as indicated. Name (print): Date: Position: Title: 6
SECTION A3 ACCESS TO PRODUCT DURING SHIPMENT PROTOCOL: NO. A3 The distribution and/or retailer facility has undertaken measures to prevent unauthorized access to CAN during shipment. Y/N AUDIT REQUIREMENTS: Written policy and procedure containing steps to comply with requirements signed by facility manager or designated responsible person Records/documentation of policy implementation NOTE: Auditors will spot check documentation to ensure policies are being followed 7
EXAMPLE ACCESS DURING SHIPMENT POLICY/PROCEDURE POLICY NAME: Access to Calcium Ammonium Nitrate (CAN) Product during Shipment OBJECTIVES: 1. To ensure measures are taken to minimize the exposure of CAN to theft or tampering during shipment. 2. To ensure measures are taken to restrict access to CAN during shipment by securing access points on the transport vehicle. 3. To ensure processes are in place to regularly inspect for and report any signs of tampering or theft on vehicles transporting CAN. CRITICAL TASK PROCEDURES: 1. Stops in Transit In order to ensure the security of all shipments of CAN, the following measures must be followed: a. If possible, all road shipments of CAN will be delivered from the loading facility to the receiving facility with no stops to minimize risks of tampering. b. If short stops are required (less than 1 hour), the driver must be in constant visual contact with the delivery vehicle at all times. c. If the driver cannot be in constant visual contact with the load during a short stop, all access slides/gates and trailer disconnect points (i.e. fifth wheel or trailer disconnect) on the delivery vehicle must be locked/sealed OR the delivery vehicle parked in a secured compound (i.e. 2-meter chain link fenced compound with locked gates). 2. Securing of Access Points All gates and hatches on any railcars and trucks delivering CAN must be locked or sealed with a cable-type seal once they have been loaded. 3. Inspection of Locks/Seals The locks or seals on the gates and hatches on railcars and trucks delivering CAN will be inspected as follows: a. All locks/seals on gates and hatches on railcars and trucks must be initially inspected by the transport operator or the shipper once the railcar/truck is loaded. The bill of lading for the shipment will be initialed by the transport operator or the shipper indicating the locks/seals are in place. b. All locks/seals of trucks are to be inspected at each stop by the transport operator. c. All locks/seals on trucks/railcars will be inspected once they have arrived at destination. 8
REVIEW: This policy/procedure is to be reviewed with all existing personnel, reviewed with all new hires and updated at least annually at employee meetings or a dedicated update session. 9
EXAMPLE TRANSPORT INSPECTION LOG Consignor (Shipper) Name: Address: Consignee (Destination) Name: Address: City: Prov/State: City: Prov/State: Shipment Date: Name of Carrier: Point of Origin (city, prov/state): Shipping Document #: Transport Unit #: Unit # Description of Articles Net Weight (scale ticket) Consignor Contact #: SECURITY INSPECTIONS NOTE: INSPECTIONS MUST BE CONDUCTED AFTER EACH STOP Date (MM/DD/YY) Time of Inspection Location of Inspection Evidence of Tampering with Hatch Locks or Seals? (Y/N) Hatch Locks or Seals Broken? (Y/N) Breach of Truck Cabin or other? (Y/N) Evidence of Product Loss? (Y/N) If Yes (Y) was selected for any of the above, please fill out the following accordingly: Estimated Weight of Product Loss (Quantity/Weight): Description of Damage/Tampering: Comments: 10
SECTION A4 LOSS OR TAMPERING OF PRODUCT DURING SHIPMENT PROTOCOL: NO. A4 The distribution and/or retail facility has undertaken measures to assess, investigate and report shortages in shipments of CAN. Y/N AUDIT REQUIREMENTS: Written policy and procedure with steps to comply with the requirements of this section signed by the facility manager or designated responsible person Records/documentation of policy implementation NOTE: Auditors will spot check documentation to ensure policies are being followed 11
EXAMPLE LOSS/TAMPERING POLICY/PROCEDURE POLICY NAME: Loss or Tampering of Product during Shipment OBJECTIVES: 1. To identify loss of calcium ammonium nitrate (CAN) during shipment. 2. To identify potential tampering of the transport vehicle while in transit. CRITICAL TASK PROCEDURES: 1. Tampering of Locks/Seals All locks and/or seals on the gates and hatches on the truck/railcar will be inspected prior to unloading to ensure they are not missing, broken or tampered with. Any missing or tampered locks and/or seals will be documented and reported to management immediately. 2. Verification of Quantities In order to verify the actual quantities of the load at destination versus the shipped weights, the following steps must be taken: REVIEW: a. If the receiving facility is equipped with a scale system large enough to weigh the transport vehicle, the net weight of the load will be determined and compared to the shipped weights. b. If the receiving facility is not equipped with a scale system large enough to weigh the transport vehicle, the load will be visually inspected for any short compartments. c. Railcar shipments will be visually inspected for any short compartments prior to unload at destination. d. Any shortages beyond historical norms of 1% of the shipped weight will be documented and reported to management. This policy/procedure is to be reviewed with all existing personnel, reviewed with all new hires and updated at least annually at employee meetings or a dedicated update session. Reporting Requirements Management Responsibilities: The company must report any loss, tampering, theft or attempted theft immediately to the seller and local authorities. Management may choose to report the incident separately to the Suspicious Incident Reporting (SIR) Program through the Royal Canadian Mounted Police. 12
SECTION A5 DELIVERY OF CALCIUM AMMONIUM NITRATE PROTOCOL: NO. A5 The distribution and/or retail facility has undertaken measures to ensure proper documentation and authorization of all incoming deliveries of CAN. Y/N AUDIT REQUIREMENTS: Written policy and procedure with steps to comply with the requirements of this section signed by the facility manager or designated responsible person Records/documentation of policy implementation NOTE: Auditors will spot check documentation to ensure policies are being followed 13
EXAMPLE DELIVERY AUTHORIZATION POLICY/PROCEDURE POLICY NAME: Calcium Ammonium Nitrate (CAN) Delivery Authorization OBJECTIVES: 1. To ensure proper authorization and clearance for delivery of CAN to avoid delivery errors. 2. To ensure accurate and complete documentation for all loads of CAN prior to authorization for unload. 3. To ensure all deliveries of CAN arrive as scheduled at their designated destination and to identify loads that have been delayed or lost. CRITICAL TASK PROCEDURES: 1. Documentation Review Prior to Unloading Prior to authorizing a shipment/unload at a CAN storage site, the receiver must: a. Verify the name and physical address of the company supplying the CAN (i.e. importer, manufacturer or distributor). b. Verify the quantity of CAN being ordered. c. Verify the name and address of the receiving company. d. Verify the storage location identified on the shipping documents. e. Verify the projected date of delivery. 2. Authorization for Unloading of Shipment Prior to unloading the CAN shipment, the transport operator must: a. Have written or verbal authorization for unload from the receiving company. b. Confirm the address for the delivery. c. Have a written or verbal indication of the exact storage location for the load to be deposited on the storage site. d. Have a representative from the receiving company sign the bill of lading. 3. Verification of Arrival at Destination In order to verify the arrival of a shipment of CAN: a. The shipping company will determine an estimated time of arrival for the shipment based upon the distance to the receiving location. 14
b. The transport operator will notify dispatch upon arrival at the storage location. Alternatively, dispatch can call the receiving location after estimated time of arrival. c. The transport operator will notify dispatch of any delays or mechanical problems that may delay the delivery time. d. The dispatcher will monitor the delivery time in order to determine if the estimated time of arrival has been exceeded. If it has, the dispatcher will attempt to contact the transport operator/receiver. If any issues are identified, the management of the shipping company will be notified immediately. REVIEW: This policy/procedure is to be reviewed with all existing personnel, reviewed with all new hires and updated at least annually at employee meetings or a dedicated update session. 15
SECTION B STORAGE OF CALCIUM AMMONIUM NITRATE 16
SECTION B1 PRODUCT STORAGE SECURITY PROTOCOL: NO. B1 The distribution and/or retail facility has undertaken measures to ensure the security of CAN storage. Y/N AUDIT REQUIREMENTS: Implementation of security measures Weekly inspection records NOTE: Auditors will spot check procedures, records and perform a visual inspection of the CAN storage facility 17
EXAMPLE KEY CONTROL SYSTEM POLICY/PROCEDURE POLICY NAME: Key Control System for Calcium Ammonium Nitrate (CAN) Storage OBJECTIVES: To control and track access to all keys to CAN storage. CRITICAL TASK PROCEDURES: In order to control the assignment and tracking of keys that provide access to CAN storage, a key control system has been implemented. The critical requirements for this system are: 1. Duplication of Keys All duplication of keys that provide access to the CAN storage areas is done under the strict consent of the facility manager. NO duplication is allowed without the written consent of the facility manager. 2. Assignment of Locksmith A designated licensed locksmith has been chosen to manage all duplication of keys providing access to CAN. The locksmith has been instructed in writing to not duplicate any keys for the facility without written consent from the facility manager. 3. Marking of Keys The locksmith has been instructed to mark all keys as Do Not Duplicate (DND) and keys have been stamped with an identification number. 4. Approval for Assignment of Keys Assignment of keys is to be done with the approval of the facility manager. 5. Documentation for Assignment of Keys Assignment of keys must be documented utilizing the Key Control Tracking Sheet. 6. Retrieval of Keys All assigned keys will be retrieved from employees once they are re-assigned to a new area of responsibility or leave the company. Lending of Keys Employees who have been assigned CAN storage keys must not lend the keys to other employees or individuals. They are solely responsible for the care and custody of the keys in their possession. REVIEW: This policy/procedure is to be reviewed with all existing personnel, reviewed with all new hires and updated at least annually at employee meetings or a dedicated update session. 18
EXAMPLE KEY CONTROL LOG CALCIUM AMMONIUM NITRATE KEY CONTROL SYSTEM Date of Assignment of Key Key ID # Employee Name Employee Signature Manager Signature Of Approval Date of Return of Key Employee Signature on Return Manager Signature Verifying Return Policy Created: Last Reviewed and Updated: 19
EXAMPLE WEEKLY SECURITY CHECKLIST Section B1 Weekly Security Inspection Checklist Date: Time: Inspector: Yes No Notes: Perimeter Security (if applicable) Fencing in good condition Padlocks present and secure Ground around fencing in good condition Lighting Facility Security Doors and entrances in good condition Locks on Doors and Entrance ways Windows in good condition Locks on windows present and secure Signage intact and visible Lighting present and operational Access to Facility Documentation is complete for visitors Documentation of authorized personnel is complete Inspector's Signature 20
SECTION B2 SECURITY PLAN PROTOCOL: NO. B2 The distribution and/or retail facility has a written, up-to-date security plan that has been disclosed to local law enforcement on an annual basis. Y/N AUDIT REQUIREMENTS: Completed security plan, updated annually, signed by the facility manager Letter or other documentation notifying the local authorities of the presence of CAN at the retail facility NOTE: Auditors will verify the presence of an up-to-date security plan and documentation confirming notification of local authorities 21
EXAMPLE SECURITY PLAN NOTE: The template is an example only with the purpose of assisting responsible persons in developing a security plan for their site(s). It may not comprehensively include all scenarios, procedures and/or regulatory requirements for a given facility. CALCIUM AMMONIUM NITRATE (CAN) SECURITY PLAN Name of Company Location Telephone Number Manager s Name: Office Phone Number: Alternative Phone Number: For events of theft, tampering, suspicious sale attempts or other security breaches during transportation, storage, handling and sale of calcium ammonium nitrate, phone: Fire: Police: RCMP Hotline: 1-800-420-5805 Last Reviewed: (MONTH, DAY, YEAR) 22
TABLE OF CONTENTS 1.0 PURPOSE...24 2.0 RISK ASSESSMENT...25 3.0 EMERGENCY PROCEDURES...26 3.1 THEFT OR TAMPERING DURING TRANSPORTATION...27 3.2 THEFT OR TAMPERING DURING STORAGE...28 3.3 SUSPICIOUS PURCHASE ATTEMPT / REFUSAL OF SALE...30 4.0 ACCESS CONTROL...31 4.1 SITE SECURITY...31 4.2 KEY CONTROL PLAN...33 4.3 EMPLOYEE & CONTRACTOR MANAGEMENT...34 4.4 TRANSPORT...35 4.5 VISITOR AUTHORIZATION...38 4.6 ACCESS TO RECORDS...39 5.0 STOCK MANAGEMENT...40 5.1 INBOUND SHIPMENT...40 5.2 STORAGE...42 5.3 OUTBOUND SHIPMENT...42 6.0 SALE OF CALCIUM AMMONIUM NITRATE...43 6.1 VERIFICATION & SALE PROCEDURES...44 6.2 SALE MEETING VERIFICATION REQUIREMENTS...45 6.3 REFUSAL OF SALE...45 7.0 OTHER DOCUMENTATION...46 7.1 LETTER TO LOCAL POLICE DEPARTMENT...46 23
1.0 PURPOSE This section could contain a brief introduction and description of the Security Plan, as well as a description of how it is organized and how it will be used at the site. In addition to this, sites may choose to use this section to list general responsibilities not associated with a specific procedure and assign the responsible person(s) for carrying out those tasks. The Security Plan must be renewed on an annual basis to ensure that the procedures and references persons/job titles are up to date. Also, staff must be trained on the procedures relevant to their roles and responsibilities. The annual review and training may be conducted by a single responsible person or broken up by section and assigned to multiple people as appropriate. An example of what this section could include can be found below. EXAMPLE: This Security Plan provides measures implemented to address identified threats to the security of calcium ammonium nitrate (CAN) and instructions for responding to a number of security events. These procedures will be used in training sessions and onboarding of new employees in order to develop and enable employees to act responsibility and appropriately in the event of a security-related incident. CAN is a security-sensitive product which can be criminally misused for the manufacture of homemade explosives. Security threats concerning CAN at this site and along the supply chain can include: Unauthorized access resulting in: o Theft o Tampering o Sabotage o Criminal misuse of product Purchase for the purpose of criminal misuse of product The instructions are organized to prioritize information based on need with emergency procedures foremost and everyday business procedures following. It must be reviewed and updated annually. All users of this Security Plan must be thoroughly familiar with their role and responsibilities in upholding a high standard of security in everyday business conditions and in the event of a security incident. Section 3.0 contains emergency procedures which will be enacted should a security breach occur. Sections 4.0 to 6.0 contain measures in place to address identified threats to product security. Section 4.0 describes the measures in place to control access to the site where product is stored and the measures by which authorization to the product storage area(s) is granted. Section 5.0 describes the procedures by which the product stock inventory is managed and secured during shipment to and from the facility as well as during storage 24
at the site. Section 6.0 includes relevant procedures for validating customers purchasing CAN, the collection and protection of customer information and refusal of sale measures. Lastly, Section 7.0 contains records of key supporting documentation. Key Tasks and Responsible Persons The following tasks are assigned to the listed responsible person(s): Task e.g. Annual Update of Security Plan and distribution e.g. Training and familiarization of staff and new employees of Security Plan procedures, roles and responsibilities Responsible Person(s) Distribution of Security Plan This Security Plan itself should be treated as a security-sensitive document. The original document and all approved copies of it should be stored in a secure location. Old versions of the Security Plan will be appropriately destroyed by deleting electronic versions and/or shredding physical paper copies. Upon review and update of the Security Plan, the following person(s) are in possession of an approved copy and will be forwarded the revised version: Copy # 1 2 3 Name Location Mailing Address/E-mail 2.0 RISK ASSESSMENT A risk assessment helps identify the vulnerabilities at a given site which would give rise to an unwanted security breach event. Identifying these scenarios will then assist in the development of appropriate responses to help address them. The number of vulnerabilities and unwanted event scenarios will depend on the size and set up of your site. The following table provides a sample table framework for listing and assessing site security risks, as well as some examples. EXAMPLE: 25
Unwanted Security Event Unexplained Losses during Storage Example of Possible Causes Unauthorized access/theft Product shrink Potential Consequences Criminal misuse Business loss Control Mechanism to Eliminate/Reduce Locks and monitored security on product storage area After-hours lighting Personnel/visitor authorization procedures Actions to Control Reporting procedure to inform local authorities of security breach Signage Unexplained Losses during Shipping by Truck Unauthorized access/theft Spill Criminal misuse Business loss Inventory, inspections and record keeping Locks and/or seals on vehicles Inspection of locks/seals by drivers after stops Inventory measures upon arrival at storage facility Reporting procedure to inform the shipper of the product and local authorities of security breach Wrongful Sale Lack of customer verification Criminal misuse Reporting of any spills to site Identification requirements for potential buyers Record keeping of customer and use information Reporting procedure to report suspicious purchase attempts Sales procedures to determine customer is a farmer 3.0 EMERGENCY PROCEDURES 26
This section contains the procedures to be followed in order to respond to a security event at the site and the assigned individual(s) or job title of the person responsible for carrying out the emergency procedure(s). Potential scenarios to consider include theft, sabotage, unauthorized access by individuals (e.g. staff, contractors, visitors, outsiders), and unexplained losses. Examples: 3.1 THEFT OR TAMPERING DURING TRANSPORTATION Describe the steps which would be taken by the site in the event that an incident of theft or tampering during shipping is reported to the site by the truck or rail operator. A copy of the site policies developed for the requirements of Sections A and C of the CAN Security Code could also be included in this section. An example of what this section could include can be found below. EXAMPLE: Site Personnel Responsibilities: List the actions which would need to take place to respond to this situation and the staff or job title which is assigned to carry out the actions in the event an incident is reported. Examples: Task Responsible for overseeing incident response and ensuring procedures are followed Gathers relevant information about the incident from the driver/transportation company upon report such as: Driver contact information Description of the occurrence Estimated losses (if applicable) Reports incident to relevant agencies (local police must be notified immediately) and acts as liaison to any follow-up investigation procedures/questions Reports incident to corporate, president, and/or other management body Name/Job Title Contact Information (if applicable) 27
(If receiving) Informs the seller of the CAN that theft/tampering was discovered Liaises with customers on any service delays Prepares documentation on incident as part of internal record keeping process Procedures List the procedures that staff and the responsible persons listed above would need to follow to respond to this situation in the event that an incident is reported. Agency Notification (List the name/organization and respective telephone numbers that will be notified in the event that theft or tampering during transportation is discovered) Name/Agency e.g. local police (immediately) Number 3.2 THEFT OR TAMPERING DURING STORAGE Describe the steps which would be taken by the site in the event that an incident of theft or tampering is discovered in the CAN storage area(s). A copy of the site policies developed for the requirements of Section B of the CAN Security Code could also be included in this section. An example of what this section could include can be found below. EXAMPLE: Site Personnel Responsibilities: List the actions which would need to take place to respond to this situation and the staff or job title which is assigned to carry out the actions in the event an incident is discovered. Examples: 28
Task Responsible for overseeing incident response and ensuring procedures are followed Investigates the suspected incident and gathers relevant information such as: Estimated losses (if applicable) Description of discovery Evidence of unauthorized access (if easily noted) Reports incident to relevant agencies (local police must be notified immediately) and acts as liaison to any follow-up investigation procedures/questions Reports incident to corporate, president, and/or other management body Prepares documentation on incident as part of internal record keeping process Coordinates repair of any damaged property/breaches of storage structure Name/Job Title Contact Information (if applicable) Procedures List the procedures that staff and the responsible persons listed above would need to follow to respond to this situation in the event that an incident is reported. Agency Notification (List the name/organization and respective telephone numbers that will be notified in the event that theft or tampering during transportation is discovered) Name/Agency e.g. local police (immediately) Number 29
3.3 SUSPICIOUS PURCHASE ATTEMPT / REFUSAL OF SALE Describe the steps which would be taken by the site in the event that an attempted purchase is deemed suspicious and/or the sale of CAN is refused. A copy of the site policies developed for the requirements of Section C of the CAN Security Code could also be included in this section. An example of what this section could include can be found below. EXAMPLE: Site Personnel Responsibilities: List the actions which would need to take place to respond to this situation and the staff or job title which is assigned to carry out the actions in the event an incident is discovered. Examples: Task Responsible for overseeing incident response and ensuring procedures are followed Gathers relevant information such as: Description of purchaser Description of purchase attempt and efforts to validate customer for legitimacy Reports incident to relevant agencies within 24 hours and acts as liaison to any follow-up investigation procedures/questions Reports incident to corporate, president, and/or other management body Name/Job Title Contact Information (if applicable) Prepares documentation on incident as part of internal record keeping process Procedures List the procedures that staff and the responsible persons listed above would need to follow to respond to this situation in the event that an incident is reported. Agency Notification 30
(List the name/organization and respective telephone numbers that will be notified in the event that theft or tampering during transportation is discovered) Name/Agency e.g. local police (within 24 hours) RCMP Hotline Number 4.0 ACCESS CONTROL This section describes the procedures in place to control access to the CAN storage area and sales records and prevent unauthorized access. Procedures should address both the management of those who need to be on site (e.g. authorized and unauthorized staff, contractors, authorized visitors, etc.) and those who are trespassing. An example of what this section could include can be found below. 4.1 SITE SECURITY Describe the security measures which are in place for the site and/or CAN storage area as well as the routine inspection/maintenance procedures that are implemented to keep all security equipment in good working order. In addition, the site rules for staff in maintaining a high level of security should also be described. A copy of protocols developed for Section B of the CAN Security Code and reference templates for record keeping or check lists could also be included. Some sample templates can be found in the CAN Code Appendices. An example of what this section could include can be found below. EXAMPLE: Security of the Site Grounds: Security Measures Implemented: System Yes No Description/Details Door Locks Signage Window Locks Security Lighting e.g. all entrances to CAN storage area e.g. signs against unauthorized access posted at all entrances to CAN storage area 31
Fencing Security System Site security measures must be inspected every week to ensure that they are in good physical condition, are operational, and that no breaches have occurred. Signage must be kept in good condition and be legible. The CAN storage area should also be inspected to make sure that all doors and windows are in good structural condition, are unbreeched and that locks are still functional. Task e.g. Conducting weekly site security inspections Responsible Person(s) or Job Title(s) Site Rules for Staff: In order to maintain the security of the site, staff should ensure that the following measures are followed: All doors, windows or other points of access of building(s) storing CAN are locked when not attended to prevent unauthorized access. The security system alarm should be set by the last staff member to leave the site at the end of the day. Perimeter security fencing should be closed and locked by the last staff member to leave the site at the end of the day. Keys which have been assigned to provide access to the CAN storage area should not be duplicated. Keys which have been assigned to provide access to the CAN storage area are the sole responsibility of the person whom they are assigned to they should not be given to another employee or individual. Only persons authorized by the site manager [or other responsible person] can assess the CAN storage area(s). Unauthorized persons, including staff, visitors and contractors, must always be accompanied by an authorized staff member within the CAN storage area(s). Authorized Employee List e.g. John Smith 32
4.2 KEY CONTROL PLAN A Key Control Plan for keys which provide access to the CAN storage area(s) must be developed, implemented and managed. In this, the availability and ability to duplicate keys must be restricted, and associated procedures to manage this must be in place. The Plan must address the requirements for keys and locks used, how the keys are managed, the persons who are permitted to have keys, and the procedures for lost, stolen or misplaced keys. Keys should only be assigned to those who need it as part of their job function and there should be a procedure in place to retire keys upon end of employment at the site. The procedures developed for Section B1 of the CAN Security Code could also be included. An example of what this section could include can be found below. EXAMPLE: OBJECTIVE: To control and track access to all keys to CAN storage. KEY CONTROL SITE PERSONNEL RESPONSIBILITIES: Task e.g. Managing the integration of new and the retirement of old keys and locks e.g. Assignment and tracking of keys to staff and contractors (if appropriate) Responsible Person(s) or Job Title(s) KEY MANAGEMENT: Every key which provides access the CAN storage area must be assigned a number that is not its original serial number, which will be tracked. Serial numbers issued by its manufacturer which are displayed on a key must be removed. It must be ensured that keys used can only be obtained directly from the manufacturer or copied by a certified locksmith when permitted by the facility manager. When not in use, keys must be kept in a locked, secure location which can only be accessed by an authorized person (e.g. lock, card, code access, etc.). Keys may be assigned for short-term or single-day use for persons who need 33
infrequent access so long as they are returned at the end of the period and this process is tracked. CRITICAL TASK PROCEDURES: (e.g. Procedures developed for key control under Section B1 Product Storage Security of the CAN Security Code with Key Control Tracking Sheet) 4.3 EMPLOYEE & CONTRACTOR MANAGEMENT Describe the measures which are in place for the site and/or CAN storage area to manage the people working at the site such as employee and contractor hiring practices. A copy of protocols developed for Section B of the CAN Security Code and reference templates could also be included. Some sample templates can be found in the CAN Code Appendices. An example of what this section could include can be found below. EXAMPLE: CURRENT EMPLOYEE LIST Name Job Title Contact CONTRACTOR LIST Name Company Contact All contractors providing services at the CAN storage facility must have documentation from the facility manager (or designate) authorizing them to perform the work. The documentation must include the date of authorization, the name of the contractor, a description of the work to be performed and the signature of the facility manager. Contractors must sign in at the main office upon arrival to the site and sign out upon leaving the site (even if returning the next day). 34
PROCEDURES FOR NEW EMPLOYEE/CONTRACTOR: (e.g. Procedures developed for personnel security under Section B3 Access by Onsite Personnel of the CAN Security Code) 4.4 TRANSPORT Describe the measures used to screen potential transportation companies for hire as well as security measures which need to be followed when CAN is being transported from one location to another. This could include protocols for marine, rail and/or truck depending on the operation. Protocols developed for Sections A and C of the CAN Security Code as well as templates used for tasks and record keeping could be included in this section. An example of what this section could include can be found below. EXAMPLE: HIRING POLICY TRUCKING SERVICES: (e.g. Procedures developed for compliance verification for inbound shipments under Section A1 and A2 Security of Inbound Cargo, and for transport certification under Section C1.1 Security Around Individuals or Company Responsible for Providing Transportation of the CAN Security Code) CAN DELIVERIES: In addition to regular shipping documentation, staff coordinating shipments of CAN to or from the site must provide to and review with the truck driver prior to loading product: 1. A copy of the Secure Transport Procedures 2. A copy of the transport inspection log template Reference copies of both listed documents can be found in the section below. If the shipping destination is to a customer, staff responsible for coordinating the delivery must also ensure that the location of the delivery is confirmed and also to provide the truck driver instructions as to whether the customer or the driver will be signing for the delivery (depending on the customer s instructions from the time of sale). Staff must also ensure that a signed copy of the delivery receipt (whether signed by customer or driver) is provided back to the site to confirm delivery (electronically or physically). 35
Secure Transport Procedures In order to ensure the security of all shipments of CAN, the following measures must be followed: 1. Stops in Transit a. If possible, all road shipments of CAN will be delivered from the loading facility to the receiving facility with no stops to minimize risks of tampering. b. If short stops are required (less than 1 hour), the driver must be in constant visual contact with the delivery vehicle at all times. c. If the driver cannot be in constant visual contact with the load during a short stop, all access slides/gates and trailer disconnect points (i.e. fifth wheel or trailer disconnect) on the delivery vehicle will have to be locked OR the delivery vehicle parked in a secured compound (i.e. 2-meter chain link fenced compound with locked gates). 2. Securing of Access Points All gates and hatches on any railcars and trucks delivering CAN must be locked or sealed with a cable type seal once they have been loaded. 3. Inspection of Locks/Seals The locks/seals on the truck delivering CAN will be inspected as follows: a. All locks/seals on gates and hatches on railcars and trucks must be initially inspected by the transport operator or the shipper once the truck is loaded. The bill of lading for the shipment will be initialed by the transport operator or the shipper indicating the seals are in place. b. All locks/seals of trucks are to be inspected at each stop by the transport operator. c. All locks/seals on the truck will be inspected once they have arrived at destination prior to unload. d. If at any point the transport operator discovers that CAN has been stolen or tampered with, or that there has been an attempt to steal or tamper with it, the driver must immediately notify the retail site so that the local police can be contacted. 4. Spills In the event of a spill of any other incident which could impact the total quantity of CAN delivered to the destination, the driver must immediately notify the retail site for their records. 36
Transport Inspection Log Template Consignor (Shipper) Name: Address: Consignee (Destination) Name: Address: City: Prov/State: City: Prov/State: Shipment Date: Name of Carrier: Transport Unit #: Unit # Description of Articles Point of Origin (city, prov/state): Shipping Document #: Net Weight (scale ticket) Consignor Contact #: Date (MM/DD/YY) Time of Inspection Location of Inspection Evidence of Tampering with Hatch Locks or Seals? (Y/N) Hatch Locks or Seals Broken? (Y/N) Breach of Truck Cabin or other? (Y/N) Evidence of Product Loss? (Y/N) SECURITY INSPECTIONS NOTE: INSPECTIONS MUST BE CONDUCTED AFTER EACH STOP If Yes (Y) was selected for any of the above, please fill out the following accordingly: Estimated Weight of Product Loss (Quantity/Weight): Description of Damage/Tampering: Comments: 37
4.5 VISITOR AUTHORIZATION Describe the measures which are in place for the CAN storage area to manage visitors, guests or other individuals who will have access to the CAN storage area and/or site grounds on an irregular basis and are not performing work for the site. Documenting guests and visitors also provides the benefit of having a record of who is on-site at a given time which can be important in the event of an emergency. Reference templates used for record keeping could also be included in this section. An example of what this section could include can be found below. EXAMPLE: Task e.g. Sign in and sign out of visitors or guests at front desk Responsible Person(s) or Job Title(s) All staff On occasion, persons who are not contractors or customers may be present on the site for various reasons. Depending on the nature of the visit, these visitors (e.g. auditors, inspectors, tour guests, etc.) may be present in areas beyond the main office or storefront. In order to maintain the security of the site, responsible staff for the visitors should ensure that the following measures are followed: Visitors must be accompanied by a responsible staff member when outside the main office at all times; Visitors should be approved by the site manager in advance (if possible); Visitors who will be in fertilizer storage areas (outside of the main office/store front) must sign in at the main office upon arrival to the site and sign out upon leaving; and Staff responsible for care of visitors should ensure that the other site staff is notified of the expected visitors and the nature of the visit. 38
4.6 ACCESS TO RECORDS Describe the measures which will be used to control access to sales records and collected customer information and protect this information from unauthorized access. Records could be physical (kept under lock and key) or electronic (password protected). Access should only be allowed to those who need it as part of their job function and there should be a procedure in place to revoke access upon end of employment at the site. A copy of protocols developed for Section C of the CAN Security Code and reference templates used for record keeping could also be included. Sample templates can be found in the CAN Code Appendices. An example of what this section could include can be found below. EXAMPLE: RECORD MANAGEMENT SITE PERSONNEL RESPONSIBILITIES: Task e.g. Collects and inputs customer information into the secure information management system e.g. Management of electronic records system database and retirement of old records e.g. Grants authority to collect information and access records by creating and assigning computer login access e.g. Able to view records e.g. Programming and technical management of secure information management system Responsible Person(s) or Job Title(s) All information collected as part of a sale of CAN will be logged into the site s database at time of sale as part of the customer s file. Access to the site database for data input or view of historical customer files will be restricted by use of login identification and password. Database login identifications will be created and assigned to person(s) requiring access only by the responsible person/job title shown in the table above. Login privileges of a person will be revoked immediately upon end of employment or transition to a new role at the 39
facility which does not require access to customer records. Staff with login privileges should abide by the following rules: Only staff who have been granted permission (through assignment of a login identifier) are permitted to access the database Do not lend out assigned login information to other colleagues even if they are permitted access to the database Computers granting access to the site database should be locked out when not attended or in use 5.0 STOCK MANAGEMENT A site must keep track of the quantity of CAN on their site. A stock management system provides a method to do this, allowing a site to reconcile their inventory against sales and/or use. The information generated from the stock management system will provide a base of information which can assist in better understanding the site s normal historical losses during storage, transportation and handling (e.g. shrink), enabling easier detection of unexplained losses and assisting in any investigations. This section describes the procedures for the site s stock management system for CAN. A copy of protocols developed for Sections A, B and C of the CAN Security Code and any reference templates to be used for record keeping could also be included. An example of what this section could include can be found below. 5.1 INBOUND SHIPMENT Describe the procedures in place used to verify that the quantity of CAN received in a shipment is close to the quantity expected and that any losses (e.g. shrink) are within historical norms for the site. This could include protocols for marine, rail and/or truck depending on the operation. Protocols developed for Sections A of the CAN Security Code as well as templates used for tasks and record keeping could be included in this section. An example of what this section could include can be found below. EXAMPLE: This Section includes the procedures that must be followed for all shipments of CAN to the facility. The follow people/job titles are responsible for delivering these described procedures as part of their daily job duties: 40
Name/Job Title CAN DELIVERIES INBOUND TO SITE This site receives shipments of CAN primarily by truck. During the initial stages of coordinating a CAN shipment inbound to the site, the staff responsible for the delivery must work with the transport company put the following measures in place required to verify the arrival of the shipment, check for tampering or losses, and provide authorization to the transport operator to unload: 1. Verification of Arrival at Destination In order to verify the arrival of a shipment of CAN: (e.g. Procedures developed for delivery authorization under Section A5 Delivery of Calcium Ammonium Nitrate ) 2. Accepting a Delivery of CAN When accepting a delivery, staff responsible for receiving the delivery must do the following: a. Ensure Delivery Authorization (e.g. Procedures developed for delivery authorization under Section A5 Delivery of Calcium Ammonium Nitrate ) b. Check for Tampering or Loss of Product During Shipment (e.g. Procedures developed for loss/tampering under Section A4 Loss or Tampering of Product During Shipment ) Suspected incidents of theft or tampering, attempted theft or tampering or other losses not attributed to normal operations which are discovered by an employee or reported by a transporter should be reported to [insert assigned responsible person/job title] immediately. 41
5.2 STORAGE This section should describe the procedures which are used to annually reconcile the quantity of product being stored at the site against inventory records and inspect the stock for signs of theft or tampering. Procedures should also note the person or job title responsible for carrying out weekly inspections of stored CAN. Protocols developed for Section B of the CAN Security Code as well as templates used for tasks and record keeping could be included in this section. An example of what this section could include can be found below. EXAMPLE: INVENTORY MANAGEMENT SITE PERSONNEL RESPONSIBILITIES: Task e.g. Weekly inspection of CAN stock for signs of theft or tampering e.g. Annual CAN inventory audit Responsible Person(s) or Job Title(s) WEEKLY INSPECTIONS: (e.g. Procedures developed for inventory management under Section B4 Loss of Product During Storage ) ANNUAL INVENTORY AUDIT: (e.g. Procedures developed for inventory management under Section B4 Loss of Product During Storage ) Suspected incidents of theft or tampering, attempted theft or tampering or other losses not attributed to normal operations should be reported to [insert assigned responsible person/job title] immediately. 5.3 OUTBOUND SHIPMENT This section would describe the procedures in place to confirm the successful delivery of CAN from the retail site to its intended destination, such as another retail location or a farm. Protocols developed for Section C of the CAN Security Code as well as templates to be used for tasks and 42
record keeping could be included in this section. An example of what this section could include can be found below. EXAMPLE: This Section includes the procedures that must be followed for all shipments of CAN leaving the facility. The follow people/job titles are responsible for delivering these described procedures as part of their daily job duties: Name/Job Title DELIVERY CONFIRMATION: (e.g. Procedures developed for obtaining a delivery receipt acknowledgement from a buyer under Section C1.2 Delivery Receipt Acknowledgement ) Suspected incidents of theft or tampering, attempted theft or tampering or other losses not attributed to normal operations which are discovered by an employee or reported by a transporter should be reported to [insert assigned responsible person/job title] immediately. 6.0 SALE OF CALCIUM AMMONIUM NITRATE This section would include a description of the procedures which would be used to validate potential customers, document, manage and store customer information, and the instructions on refusing sales which are considered suspicious. An example of what this section could include can be found below. EXAMPLE: This Section includes the procedures that must be followed for all sales of CAN by the facility. The follow people/job titles are responsible for delivering these described procedures as part of their daily job duties: Name/Job Title 43
6.1 VERIFICATION & SALE PROCEDURES Describe the procedures used to verify customers who are interested in purchasing CAN particularly new customers whom the retail outlet has never had prior business with before. Before a sale can proceed, the retailer must be satisfied that the potential customer has a legitimate agronomic need for CAN and staff must be trained to recognize the conditions which would not meet the verification requirements of the facility which could potentially lead to a sale refusal. Sales can also be refused if an employee has reasonable grounds to suspect that the CAN will be used for a criminal purpose. This section should describe the conditions which employees should look for that could result in a sale refusal. Procedures should include the criteria which must be met and the acceptable conditions of meeting them, as well as any company policies set which may add other rules for the sale. Protocols developed for Section C of the CAN Security Code as well as templates to be used for tasks and record keeping could be included in this section. An example of what this section could include can be found below. EXAMPLE: CUSTOMER VALIDATION: This outlet will abide by our corporate company policy which does not accept cash as a method of payment for sales of ammonium nitrate or CAN. Prior to proceeding with a sale and issuing clearance for a customer to acquire CAN from this outlet, the employee coordinating the sale must screen potential customers to ensure that they have a legitimate need for CAN. CRITICAL TASK PROCEDURES: (e.g. Procedures developed for customer validation under Section C3 Validation of Customers ) Potential Red-Flag Conditions: (examples) Orders an unreasonable quantity Orders out of season 44